Add sandbox-image VM flag

.travis.yml

@@ -23,7 +23,7 @@ install:
   curl -sSL https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${ARCH}-${CNI_VERSION}.tgz | sudo tar -xz -C /opt/cni/bin
 
 before_script:
-- make ignite ignite-spawn bin/amd64/Dockerfile GO_MAKE_TARGET=local GIT_VERSION=v0.0-${TRAVIS_COMMIT}-e2e  # bypass hack/ldflags.sh -- no tag info in shallow clone
+- make ignite ignite-spawn bin/amd64/Dockerfile GO_MAKE_TARGET=local
 
 script:
 - make test

Makefile

@@ -34,11 +34,11 @@ FIRECRACKER_VERSION:=$(shell cat hack/FIRECRACKER_VERSION)
 GO_VERSION=1.14.2
 DOCKER_USER?=weaveworks
 IMAGE=$(DOCKER_USER)/ignite
-GIT_VERSION:=$(shell hack/ldflags.sh --version-only)
+GIT_VERSION:=$(shell DOCKER_USER=$(DOCKER_USER) hack/ldflags.sh --version-only)
 IMAGE_DEV_TAG=dev
-IMAGE_TAG:=$(shell IGNITE_GIT_VERSION=$(GIT_VERSION) hack/ldflags.sh --image-tag-only)
+IMAGE_TAG:=$(shell IGNITE_GIT_VERSION=$(GIT_VERSION) DOCKER_USER=$(DOCKER_USER) hack/ldflags.sh --image-tag-only)
 # IS_DIRTY is 1 if the tree state is dirty, otherwise 0
-IS_DIRTY:=$(shell echo ${GIT_VERSION} | grep -o dirty | wc -l)
+IS_DIRTY:=$(shell echo ${GIT_VERSION} | grep -c dirty)
 PROJECT = github.com/weaveworks/ignite
 APIS_DIR = ${PROJECT}/pkg/apis
 API_DIRS = ${APIS_DIR}/ignite,${APIS_DIR}/ignite/v1alpha1,${APIS_DIR}/ignite/v1alpha2,${APIS_DIR}/meta/v1alpha1
@@ -75,6 +75,7 @@ TEST_COUNT := 1
 TEST_REQUIRES_ROOT_PACKAGES="$(PROJECT)/pkg/runtime/containerd"
 TEST_E2E_PACKAGES="$(PROJECT)/e2e"
 
+
 # Default is to build all the binaries for this architecture
 all: build-all-$(GOARCH)
 
@@ -111,7 +112,7 @@ go-in-docker: # Do not use directly -- use $(GO_MAKE_TARGET)
 # Make make execute this target although the file already exists.
 .PHONY: bin/$(GOARCH)/ignite bin/$(GOARCH)/ignite-spawn bin/$(GOARCH)/ignited
 bin/$(GOARCH)/ignite bin/$(GOARCH)/ignited bin/$(GOARCH)/ignite-spawn: bin/$(GOARCH)/%:
-	CGO_ENABLED=0 GOARCH=$(GOARCH) go build -mod=vendor -ldflags "$(shell IGNITE_GIT_VERSION=$(GIT_VERSION) ./hack/ldflags.sh)" -o bin/$(GOARCH)/$* ./cmd/$*
+	CGO_ENABLED=0 GOARCH=$(GOARCH) go build -mod=vendor -ldflags "$(shell IGNITE_GIT_VERSION=$(GIT_VERSION) DOCKER_USER=$(DOCKER_USER) ./hack/ldflags.sh)" -o bin/$(GOARCH)/$* ./cmd/$*
 ifeq ($(GOARCH),$(GOHOSTARCH))
 	ln -sf ./$(GOARCH)/$* bin/$*
 endif
@@ -130,33 +131,31 @@ endif
 	$(DOCKER) build -t $(IMAGE):${IMAGE_DEV_TAG}-$(GOARCH) \
 		--build-arg FIRECRACKER_VERSION=${FIRECRACKER_VERSION} \
 		--build-arg FIRECRACKER_ARCH_SUFFIX=${FIRECRACKER_ARCH_SUFFIX} bin/$(GOARCH)
-	# Load the dev image into the host's containerd content store
 	$(DOCKER) image save $(IMAGE):${IMAGE_DEV_TAG}-$(GOARCH) \
 		| $(CTR) -n firecracker image import -
 ifeq ($(GOARCH),$(GOHOSTARCH))
 	# Only tag the development image if its architecture matches the host
 	$(DOCKER) tag $(IMAGE):${IMAGE_DEV_TAG}-$(GOARCH) $(IMAGE):${IMAGE_DEV_TAG}
-	# Load the dev image into the host's containerd content store
 	$(DOCKER) image save $(IMAGE):${IMAGE_DEV_TAG} \
 		| $(CTR) -n firecracker image import -
 endif
+ifneq (${IMAGE_TAG},)
 ifeq ($(IS_DIRTY),0)
 	$(DOCKER) tag $(IMAGE):${IMAGE_DEV_TAG}-$(GOARCH) $(IMAGE):${IMAGE_TAG}-$(GOARCH)
-	# Load the dev image into the host's containerd content store
 	$(DOCKER) image save $(IMAGE):${IMAGE_TAG}-$(GOARCH) \
 		| $(CTR) -n firecracker image import -
 ifeq ($(GOARCH),$(GOHOSTARCH))
 	# For dev builds for a clean (non-dirty) environment; "simulate" that
 	# a manifest list has been built by tagging the docker image
 	$(DOCKER) tag $(IMAGE):${IMAGE_TAG}-$(GOARCH) $(IMAGE):${IMAGE_TAG}
-	# Load the dev image into the host's containerd content store
 	$(DOCKER) image save $(IMAGE):${IMAGE_TAG} \
 		| $(CTR) -n firecracker image import -
 endif
 endif
 ifeq ($(IS_CI_BUILD),1)
 	$(DOCKER) save $(IMAGE):${IMAGE_TAG}-$(GOARCH) -o bin/$(GOARCH)/image.tar
 endif
+endif
 
 build-all: $(addprefix build-all-,$(GOARCH_LIST))
 build-all-%:

cmd/ignite/cmd/vmcmd/create.go

@@ -9,7 +9,7 @@ import (
 	"github.com/spf13/pflag"
 	"github.com/weaveworks/ignite/cmd/ignite/cmd/cmdutil"
 	"github.com/weaveworks/ignite/cmd/ignite/run"
-	"github.com/weaveworks/ignite/pkg/constants"
+	"github.com/weaveworks/ignite/pkg/version"
 )
 
 // NewCmdCreate creates a new VM given an image and a kernel
@@ -40,7 +40,7 @@ func NewCmdCreate(out io.Writer) *cobra.Command {
 					--ssh \
 					--memory 2GB \
 					--size 6GB
-		`, constants.DEFAULT_KERNEL_IMAGE)),
+		`, version.GetIgnite().KernelImage.String())),
 		Args: cobra.RangeArgs(0, 1),
 		Run: func(cmd *cobra.Command, args []string) {
 			cmdutil.CheckErr(func() error {
@@ -77,6 +77,7 @@ func addCreateFlags(fs *pflag.FlagSet, cf *run.CreateFlags) {
 	cmdutil.SizeVar(fs, &cf.VM.Spec.Memory, "memory", "Amount of RAM to allocate for the VM")
 	cmdutil.SizeVarP(fs, &cf.VM.Spec.DiskSize, "size", "s", "VM filesystem size, for example 5GB or 2048MB")
 	cmdutil.OCIImageRefVarP(fs, &cf.VM.Spec.Kernel.OCI, "kernel-image", "k", "Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules")
+	cmdutil.OCIImageRefVar(fs, &cf.VM.Spec.Sandbox.OCI, "sandbox-image", "Specify an OCI image for the VM sandbox")
 	cmdutil.SSHVar(fs, &cf.SSH)
 	cmdutil.VolumeVarP(fs, &cf.VM.Spec.Storage, "volumes", "v", "Expose block devices from the host inside the VM")
 }

cmd/ignite/run/cp_test.go

@@ -106,6 +106,13 @@ func TestNewCPOptions(t *testing.T) {
 			}
 			vm.SetKernel(kernel)
 
+			// Set sandbox image without a helper.
+			ociRefSandbox, err := meta.NewOCIImageRef("foo/bar:latest")
+			if err != nil {
+				t.Errorf("failed to create new image reference: %v", err)
+			}
+			vm.Spec.Sandbox.OCI = ociRefSandbox
+
 			// Save object.
 			if err := ic.VMs().Set(vm); err != nil {
 				t.Errorf("failed to store VM object: %v", err)

cmd/ignite/run/create_test.go

@@ -19,14 +19,21 @@ func TestConstructVMFromCLI(t *testing.T) {
 		t.Fatalf("error parsing image: %v", err)
 	}
 
+	testSandboxImage := "weaveworks/ignite:test"
+	sandboxOCIRef, err := meta.NewOCIImageRef(testSandboxImage)
+	if err != nil {
+		t.Fatalf("error parsing image: %v", err)
+	}
+
 	tests := []struct {
-		name            string
-		createFlag      *CreateFlags
-		args            []string
-		wantCopyFiles   []api.FileMapping
-		wantPortMapping meta.PortMappings
-		wantSSH         api.SSH
-		err             bool
+		name             string
+		createFlag       *CreateFlags
+		args             []string
+		wantCopyFiles    []api.FileMapping
+		wantPortMapping  meta.PortMappings
+		wantSSH          api.SSH
+		wantSandboxImage meta.OCIImageRef
+		err              bool
 	}{
 		{
 			name: "with VM name and image arg",
@@ -128,6 +135,20 @@ func TestConstructVMFromCLI(t *testing.T) {
 			args: []string{testImage},
 			err:  true,
 		},
+		{
+			name: "with sandbox image",
+			createFlag: &CreateFlags{
+				VM: &api.VM{
+					Spec: api.VMSpec{
+						Sandbox: api.VMSandboxSpec{
+							OCI: sandboxOCIRef,
+						},
+					},
+				},
+			},
+			args:             []string{testImage},
+			wantSandboxImage: sandboxOCIRef,
+		},
 	}
 
 	for _, rt := range tests {
@@ -164,6 +185,11 @@ func TestConstructVMFromCLI(t *testing.T) {
 				if reflect.DeepEqual(rt.createFlag.VM.Spec.SSH, rt.wantSSH) {
 					t.Errorf("expected VM.Spec.SSH to be %v, actual: %v", rt.wantSSH, rt.createFlag.VM.Spec.SSH)
 				}
+
+				// Check if the sandbox image is set as expected.
+				if rt.createFlag.VM.Spec.Sandbox.OCI != rt.wantSandboxImage {
+					t.Errorf("expected VM.Spec.Sandbox to be %v, actual: %v", rt.wantSandboxImage, rt.createFlag.VM.Spec.Sandbox.OCI)
+				}
 			}
 		})
 	}

cmd/ignite/run/ps_test.go

@@ -62,6 +62,13 @@ func createTestVM(name, id string) (*api.VM, error) {
 	}
 	vm.SetKernel(kernel)
 
+	// Set sandbox image without a helper.
+	ociRefSandbox, err := meta.NewOCIImageRef("foo/bar:latest")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create new image reference: %v", err)
+	}
+	vm.Spec.Sandbox.OCI = ociRefSandbox
+
 	return vm, nil
 }
 

cmd/ignite/run/rm_test.go

@@ -129,6 +129,13 @@ func TestNewRmOptions(t *testing.T) {
 				}
 				vm.SetKernel(kernel)
 
+				// Set sandbox image without a helper.
+				ociRefSandbox, err := meta.NewOCIImageRef("foo/bar:latest")
+				if err != nil {
+					t.Errorf("failed to create new image reference: %v", err)
+				}
+				vm.Spec.Sandbox.OCI = ociRefSandbox
+
 				// Save object.
 				if err := ic.VMs().Set(vm); err != nil {
 					t.Errorf("failed to store VM object: %v", err)

cmd/ignite/run/testdata/output/inspect-json.txt

@@ -10,6 +10,9 @@
     "image": {
       "oci": "foo/bar:latest"
     },
+    "sandbox": {
+      "oci": "foo/bar:latest"
+    },
     "kernel": {
       "oci": "foo/bar:latest"
     },

cmd/ignite/run/testdata/output/inspect-yaml.txt

@@ -13,6 +13,8 @@ spec:
     oci: foo/bar:latest
   memory: 0B
   network: {}
+  sandbox:
+    oci: foo/bar:latest
   storage: {}
 status:
   image:

docs/cli/ignite/ignite_create.md

@@ -34,20 +34,21 @@ ignite create <OCI image> [flags]
 ### Options
 
 ```
-      --config string            Specify a path to a file with the API resources you want to pass
-  -f, --copy-files strings       Copy files/directories from the host to the created VM
-      --cpus uint                VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
-  -h, --help                     help for create
-      --kernel-args string       Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
-  -k, --kernel-image oci-image   Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:4.19.47)
-  -l, --label stringArray        Set a label (foo=bar)
-      --memory size              Amount of RAM to allocate for the VM (default 512.0 MB)
-  -n, --name string              Specify the name
-  -p, --ports strings            Map host ports to VM ports
-      --require-name             Require VM name to be passed, no name generation
-  -s, --size size                VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
-      --ssh[=<path>]             Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
-  -v, --volumes volume           Expose block devices from the host inside the VM
+      --config string             Specify a path to a file with the API resources you want to pass
+  -f, --copy-files strings        Copy files/directories from the host to the created VM
+      --cpus uint                 VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
+  -h, --help                      help for create
+      --kernel-args string        Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
+  -k, --kernel-image oci-image    Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:4.19.47)
+  -l, --label stringArray         Set a label (foo=bar)
+      --memory size               Amount of RAM to allocate for the VM (default 512.0 MB)
+  -n, --name string               Specify the name
+  -p, --ports strings             Map host ports to VM ports
+      --require-name              Require VM name to be passed, no name generation
+      --sandbox-image oci-image   Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
+  -s, --size size                 VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
+      --ssh[=<path>]              Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
+  -v, --volumes volume            Expose block devices from the host inside the VM
 ```
 
 ### Options inherited from parent commands

docs/cli/ignite/ignite_run.md

@@ -41,6 +41,7 @@ ignite run <OCI image> [flags]
   -n, --name string                       Specify the name
   -p, --ports strings                     Map host ports to VM ports
       --require-name                      Require VM name to be passed, no name generation
+      --sandbox-image oci-image           Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
   -s, --size size                         VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
       --ssh[=<path>]                      Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
   -v, --volumes volume                    Expose block devices from the host inside the VM

docs/cli/ignite/ignite_vm_create.md

@@ -34,20 +34,21 @@ ignite vm create <OCI image> [flags]
 ### Options
 
 ```
-      --config string            Specify a path to a file with the API resources you want to pass
-  -f, --copy-files strings       Copy files/directories from the host to the created VM
-      --cpus uint                VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
-  -h, --help                     help for create
-      --kernel-args string       Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
-  -k, --kernel-image oci-image   Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:4.19.47)
-  -l, --label stringArray        Set a label (foo=bar)
-      --memory size              Amount of RAM to allocate for the VM (default 512.0 MB)
-  -n, --name string              Specify the name
-  -p, --ports strings            Map host ports to VM ports
-      --require-name             Require VM name to be passed, no name generation
-  -s, --size size                VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
-      --ssh[=<path>]             Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
-  -v, --volumes volume           Expose block devices from the host inside the VM
+      --config string             Specify a path to a file with the API resources you want to pass
+  -f, --copy-files strings        Copy files/directories from the host to the created VM
+      --cpus uint                 VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
+  -h, --help                      help for create
+      --kernel-args string        Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
+  -k, --kernel-image oci-image    Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:4.19.47)
+  -l, --label stringArray         Set a label (foo=bar)
+      --memory size               Amount of RAM to allocate for the VM (default 512.0 MB)
+  -n, --name string               Specify the name
+  -p, --ports strings             Map host ports to VM ports
+      --require-name              Require VM name to be passed, no name generation
+      --sandbox-image oci-image   Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
+  -s, --size size                 VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
+      --ssh[=<path>]              Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
+  -v, --volumes volume            Expose block devices from the host inside the VM
 ```
 
 ### Options inherited from parent commands

docs/cli/ignite/ignite_vm_run.md

@@ -41,6 +41,7 @@ ignite vm run <OCI image> [flags]
   -n, --name string                       Specify the name
   -p, --ports strings                     Map host ports to VM ports
       --require-name                      Require VM name to be passed, no name generation
+      --sandbox-image oci-image           Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
   -s, --size size                         VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
       --ssh[=<path>]                      Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
   -v, --volumes volume                    Expose block devices from the host inside the VM

go.mod

@@ -55,9 +55,10 @@ require (
 	github.com/vishvananda/netlink v1.1.0
 	github.com/weaveworks/gitops-toolkit v0.0.0-20200410161308-f0fc148681c0
 	golang.org/x/crypto v0.0.0-20200406173513-056763e48d71
+	golang.org/x/net v0.0.0-20200226121028-0de0cce0169b // indirect
 	golang.org/x/sys v0.0.0-20200409092240-59c9f1ba88fa
 	gotest.tools v2.2.0+incompatible
 	k8s.io/apimachinery v0.18.1
-	k8s.io/kube-openapi v0.0.0-20200403204345-e1beb1bd0f35
+	k8s.io/kube-openapi v0.0.0-20200427153329-656914f816f9
 	sigs.k8s.io/yaml v1.2.0
 )

go.sum

@@ -539,6 +539,8 @@ golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=